I feel like using git for a sensitive code distribution is a poor idea. Git exposes rather a lot of information about you, from basic ones like username to a history of commits (what if you accidentally committed something revealing PII?)
It's much better to simply distribute code as a tar.gz archive or something.
I mean, if you're going so far as to set up git as a tor service, it probably isn't that much more work to obfuscate or just delete user info from commits.
But I'm not sure a vcs is what you'd want anyway. It might make more sense to just host a zip of the most recent branch state instead of exposing the history
